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The original two-way continuous- variable quantum- key-distribution (CV QKD) proto- 
cols [S. Pirandola, S. Mancini, S. Lloyd, and S. L. Braunstein, Nature Physics 4, 726 
(2008)] give the security against the collective attack on the condition of the tomography 
of the quantum channels. We propose a family of new two-way CV QKD protocols and 
prove their security against collective entangling doner attacks without the tomography 
of the quantum channels. The simulation result indicates that the new protocols main- 
tain the same advantage as the original two-way protocols whose tolerable excess noise 
surpasses that of the one-way CV-QKD protocol. We also show that all sub-protocols 
within the family have higher secret key rate and much longer transmission distance 
than the one-way CV-QKD protocol for the noisy channel. 

Keywords: Two-way CV QKD; collective entangling doner attacks; security. 



1. Introduction 

Quantum key distribution is well applied to cryptography due to its unconditional 
security based on quantum mechanics In particular, continuous- variable quantum 
key distribution (CV QKD) has attracted much attention in recent years because it 
has p otential ly faster and more efficient detection and key rate than single-photon 
QKD .121314151 One-way CV QKD allows the quantum state to pass through the 
channel only from the sender (Alice) to the receiver (Bob), which brings a limitation 
that the channel loss is no more than 3 dB in direct reconciliation.^ Although the 
post-selectiorP or the reverse reconciliatiorPl^ overcomes this drawback, the secret 
key rate is strongly affected by excess noise.'^ To enhance the tolerable excess 
noise, the two-way CV-QKD protocols are proposed to go beyond the 3 dB limit 
and meanwhile tolerate more excess noise than one-way protocols. 

The procedure of implementing the original two-way C V protocol is briefly intro- 
duced below. The entanglement-based (EB) scheme of a sub-protocol in the ori ginal 
two-way protocols, Het'^ protocol, is shown in Fig. 1(a), and can be described asff^IS] 
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Step one. Bob initially prepares an EPR pair with variance V and keeps one 
mode Bi while sending the other mode C\ to Alice through the channel where Eve 
may perform her attack. 

Step two. Alice encodes her information by applying a random phase-space dis- 
placement operator D{a) to her received mode Ain and then sends the mode Aout 
back to Bob through the channel. Note that a — {Qa + ^Pa)!'^-, and Qa or Pa has 
a random Gaussian modulation with the variance of 1^ — 1, respectively. 

Step three. Bob measures both his original mode B\ and received mode B2 with 
heterodyne detection to get the variables xb^x and pb^p as well as xb^x and psgp ; 
respectively. 

Step four. Alice and Bob implement the postprocessing including reconciliation 
and privacy amplification. "'^"'^ In this procedure, Bob needs to combine both out- 
comes from Bi and B2 to construct the optimal estimator to Alice's corresponding 
variables {Qa, Pa}- After the steps above, Alice and Bob can share a string of 
identical key that Eve does not know. 

However, to analyze the security under general collective attack, the original 
two-way protocols need to construct the hybrid protocol where Alice randomly 
switches between one-way (switch OFF, where Alice detects the incoming mode 
and sends a new state back to Bob) and two-way schemes (switch ON) for imple- 
menting the tomography of th e quantum channels and for both parameter estima- 
tion and key distribution,tiSEl as shown in Fig.l. This hybrid scheme increases the 
complexity in a real setup. Moreover, it is difficult to implement the tomography 
of quantum channels in a real experiment. In this paper, we modify the original 
two-way protocol by replacing the displacement operation and the ON-OFF switch 
with a passive operation on Alice's side, and give a feasible prepare-and-measure 
(PM) scheme, which pushes the two-way protocol to be easily applied in practice. 
Considering that Gaussian collective attack is optimal, we will prove the security 
of the new protocol under collective entangling doner attacks which are a special 
case of general Gaussian collective attack thoroughly researched in Ref. [121 1131 This 
paper is organized as follows. Section 2 contains the statements of our new two-way 
CV-QKD protocol. In Sec. 3, we give a theoretical analysis of the security of the 
new two-way CV-QKD protocol against Gaussian collective attack by using the 
optimality of Gaussian collective attack. In Sec. 4, we investigate the numerical 
simulation of the secret key rate under collective entangling doner attacks. Finally, 
in Sec. 5, we conclude our results and indicate some open questions. 

2. A New Tv^ro-Way CV QKD Protocol 

We modify the original two-way protocols by replacing the displacement operation 
and the ON-OFF switch with the passive operation on Alice's side. The EB scheme 
of Het^ protocol after modifying the Het^ protocol is shown in Fig. 1(b). In Het^, 
the second and fourth steps of Het'^ are changed into 

Step two'. With using a beam splitter (transmittance: Ta), Alice couples one 
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mode of another EPR pair (variance: Va) with the received mode Ain from Bob 
and sends the coupling mode Aout back to Bob. She also measures the other mode 
Ax of this EPR pair with heterodyne detection to get the variables {xaxx^ PAip} 
and randomly measures the position quadrature x or the momentum quadrature p 
of the coupling mode A2 from the beam splitter with homodyne detection. 

Step four' . Alice and Bob impl eme nt the postprocessing including the rec- 
onciliation and privacy amplification.^m In this procedure, the homodyne detec- 
tion on the mode A2 is used to estimate the channel's parameters and Bob uses 
xb = XB2X ~ kxBix pb = PB2P + kpBip to construct the optimal estimator to 
Alice's corresponding variables {xaixi PAip}, where k is the channel's total trans- 
mittance which is obtained by reconciliation. The other steps of Het^ are the same 
as those of Het^. 

In Fig. 1(b), Alice's beam splitter Ta couples the two uncorrelated states re- 
spectively from Alice and Bob. The action of the beam splitter Ta is equivalent to 
a unitary transformation. One output mode A2 of this beam splitter is kept and 
measured on Alice's side and the other mode Aout is sent to Bob though the chan- 
nel. The effects of system parameters and environment parameters on entanglement 
are discussed in detail in Ref. [T31 Here the two channels affect the entanglement 
degrees of those three pairs of states: Bi and A2, Bi and B2, and Ai and B2. The 
effect on the channels can be ascribed to the action of Eve. Considering one-mode 
Gaussian attack, the two channels can be described as two independent Gaussian- 
Entangling-Cloner attacks.^I^ It is necessary to estimate the channel's parameters 
by the measurement values of Alice and Bob in security analysis. 

The PM scheme of Het^j_protocol is shown in Fig. 1(c), which is equivalent to 
the EB scheme in Fig. 1(b). IS! In Fig 1(c), with using the random numbers m and 
n, Bob randomly modulates the amplitude (A) and the phase {(jj) of the coherent 
state from his laser source (LSI), and then sends the state to Alice. Alice's laser 
source (LS 2) is coherent with Bob's LSI by phaselock and time synchronization 
techniques.^^ Similar to Bob's modulation, Alice uses two other random numbers 
r and s to encode information. After that, the beam splitter (transmittance: Ta) 
couples Alice's signal with the signal from Bob's side, and outputs one mode back to 
Bob and another mode measured with homodyne detection. At last, the returned 
mode is measured with heterodyne detection on Bob's side. Note that the local 
oscillator and the switch which randomly controls the homodyne detection to detect 
the X or p quadrature are omitte d for concision in Fig. 1. 

In addition, the other originaff^ (e.g., Hom^) can be modified to new proto- 
col (e.g., Homfj) by changing the displacement into the couphng of the EPR pair, 
correspondingly. According to Bob's detection, we also propose a new sub-protocol 
Hom-HetM (Het-HomM ) where Bob measures his mode Bi with homodyne (hetero- 
dyne) detection and measures his mode B2 with heterodyne (homodyne) detection. 
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(c) 



Fig. 1. (a) The EB scheme of hybrid Het^ protocol. Bob measures one half of the EPR pair 
(EPR) with heterodyne detection and sends the other half to Alice. After through the path switch 
ON or OFF on Alice's side, the back state B2 is measured with heterodyne detection. There are 
two independent Gaussian-Entangling-Cloner attacks (with variances Wi and W2) on the channels 
whose transmittances are modeled by two beam splitters. The letters (e.g., Bi) beside arrows: the 
mode at the corresponding position; crescent: detection; the circle: new state; the dashed box at 
Bi and B2: the heterodyne detection, (b) The EB scheme of Het£j protocol. It is the same as (a) 
on Bob's side. On Alice's side, Alice measures one mode of her EPR pair (EPR') with heterodyne 
detection and measures one mode from a beam splitter with the transmittance Ta by homodyne 
detection. The other mode from this beam splitter is returned back to Bob. (c) The PM scheme of 
Het£j protocol. Bob sends a coherent state to Alice, then measures the back state with heterodyne 
detection to get the position (a^Sjx ) momentum {pb2p ) quadratures. Alice gets another 

value Xji^ by the homodyne detection. LSI and LS2: laser source; A: amplitude modulator; rp: 
phase modulator; m, n, r and s: random number generator. 




Fig. 2. The equivalent scheme to Fig. 1 (b). Bob uses two unitary transformations Fj. to change 
the modes B2X and {B2P and -Bip) into B-j and B4 (B5 and Bq), where Fj. is a CV C-NOT 

gate. By homodyne detection on the position (momentum) quadrature of S4 {Bg), xb {pb) is 
obtained. The dashed line into beam splitter: vacuum state. 
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Security of New Two- Way Continuous- Variable Quantum Key Distribution Protocol 5 

3. A Theoretical Analysis of the Security of the New Two- Way 
Protocol 

We consi der the EB scheme of Hetfj protocol in reverse reconciliation. The secret 
key rate iJKIIII 

Kr = PIba-Ibe, (1) 

where /3 is the reconciliation efficiency, Iba is the mutual information between Alice 
and Bob, Ibe is the mutual information between Eve and Bob. 

According to step four' , in Fig. 1(b), Iba = log2 (V'^m /V^aj |b) , where V^m and 
Vj^M^B are Alice's variance and conditional variance on Bob, respectively.^ /ba can 
be obtained with Alice's and Bob's data. As far as Ibe is concerned, according to 
Holevo bound, -Is] we get 

Ibe = S{E)-S{E\xb,pb), (2) 

where S{E) is Eve's von Neumann entropy and S{E\xb,Pb) is Eve's conditional 
von Neumann entropy on Bob's data. 

Because the calculation of S{E\xb,Pb) relates to Bob's postprocessing, in order 
to obtain the secret key rate. Fig. 2 instead of Fig. 1(b) is used for security analysis. 
In Fig. 2, Bob applies two unitary transformations to the modes B2X and Bix 
as well as to the modes Bip and B2P , respectively, in order to get xb (pb) by 
measuring the position (momentum) quadrature of B4 (or Bq). Note the order 
of the transformation, e.g., {xB^^PBi, xb^^PBsV = ^kixB2x^PB2x^XBtx^PBixV ^ 
where xb^, PBh xb^ and pb^ are the x and p quadratures of the modes B^ and B^ 
and Ffe is a continuous-variable C-NOT gate^*^ 20^21^ 



/I ~k 0\ 
1 



(3) 



00 1 

Vofc 1) 

Considering the assumption that Eve has no access to the interior of Bob,^ Eve 
obtains the information only from Bob's input and output. Because the unitary 



transformation Fj, doesn't change the von Neumann entropy of the systerrPSl 
B2xBixB2pBipA2AixAipE and the variables xb and pB are same to both Figs. 
1(b) and 2, Eve's von Neumann entropy and conditional von Neumann entropy on 
Bob in Fig. 2 are equivalent to those in Fig. 1(b). A detailed proof can be seen 
in Appendix A. In addition, taking into account that Iba is the same for both 
systems, the secret key rate is same to both Figs. 1(b) and 2. Thus, we use Fig. 2 
to analyze the security in the following. 

First, we show that the Gaussian attack is optimal to the new protocol. Accord- 
ing to the step two' and step three of the protocol Het^, Alice and Bob measure 
the mode A2 with homodyne detection and measure the modes Ai , Bi and B2 with 
heterodyne detection. This is equivalent to the scheme that Alice and Bob measure 
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the mode Ai with heterodyne detection and measure the modes A2, i?3, i?4, -B5 
and Bq with homodyne detection in Fig. 2, i.e., Ahce and Bob measure all modes 
except Eve's modes. In Fig. 2, p^;, pB and pA denote the states of Eve, the modes 
BaBq and the modes A2A1XA1PB3B5, respectively. It is easily seen that ^abe is 
a pure state and pab is the purification of pE- Because Alice and Bob's heterodyne 
or homodyne detection on their modes does not mix the x and p quadratures and 
Alice and Bob use the second-order moments of the quadratures to calculate the 
secret key rate bound, the new pro toco l can satisfy the requirement of the opti- 
mality of Gaussian collective attack.l^Ql Thus, when the corresponding covariance 
matrix T ab of Pab is known and fixed for Alice and Bob, the Gaussian attack is 

00 00 'ocl 

optimal.^ ^Therefore, Eve's accessible information can be bounded by only 

considering Eve's Gaussian collective attack. In the following part, Ibe is calculated 
using some ideas proposed in Ref. 26;. 

Second, to calculate S{E), one needs to know S{pab) because ipABE is a pure 
state and S{E) — S{pab)- The entropy S{pab) of the Gaussian state pab is cal- 
culated according to its corresponding covariance matrix F^^. Note that 

= [Pfe ® Ffc © I3] ^B2xBixBipB2pA2AixAip © Ffc © 1^]^ , (4) 

where I3 is a 6x 6 identity matrix and ^ B2xBixBipB2pA2AixAip is the corresponding 
covariance matrix of the state B2X B2P Bix B1PA2A1X Aip or (seen in Appendix 

B) 

/ IB2X ^-lB2x C*! -Ci C2 C3 -C3 \ 
^lB2x IB2P — Cl Ci — C2 — C3 C3 



^B2xB2pBixBipA2AixAip 



Cl -Cl iii^I i^I C4 



-Cl Cl i^I iii^I -C4 
C2 — C2 C4 — C4 C5 — C5 



C3 -C3 C5 



I + Vatt 1-Va ] 

2 2 
1-Vav 1 + Va-i 



(5) 



V -C3 C3 -C5 

in which I is a 2 x 2 identity matrix. In Eq. ([5]), the diagonal elements corre- 
spond to the variances of x and p quadratures of the modes -82X7 B2P, Bix, 
Bip, A2, Aix and Aip in turn, e.g., jb2x = diag{{xg^^) , {p%^^)), and the 
nondiagonal elements correspond to the covariances between modes, e.g., C2 = 
diag{{xB2x^A2)i{PB2xPA2))^ where xbsxi PB2x^ ^A2 and PA2 are the x and p 
quadratures of the modes B2X and A2, respectively. In experiment, the covari- 
ance matrix Eq. ([5]) can be calculated by the reconciliation in which Alice and Bob 
reveal some randomly chosen measurement values obtained by heterodyne detection 
on the modes i?2, Bi, Ai and homodyne detection on the mode A2. Note that the 
X and p quadratures are simultaneously obtained in the heterodyne detection, but 
Alice needs to randomly measure the x or p quadrature of the mode A2 to obtain 
the corresponding values of the x and p quadratures of the mode A2. Therefore, 
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Eve's entropjJ2II 

7 7 

5(£;)=^G(A0 = ^G(/a. (6) 

i=l i=l 

where 

G(A.) = ^— log^ _log__, (7) 

and Ai = /a - (am„) is the symplectic eigenvalue of T ab which is the function of the 
element Umn of T ab, seen in Appendix C. 

Third, S{E\xb,Pb) — S[B^BzA2AixAip\xb,Pb) because the state 
B^B^A^AixAipE is a pure state when Bob gets xb and pb by measuring the 
modes -B4 and i?6- The corresponding covariance matrix ^'slBsAiAixAip 
state B3B5A2A1XA1P conditioned on xb and pB can be obtained from 

r^j2Ql28] 

where ^BaB5A2AixAip, iBi and 75,3 are the corresponding reduced matrixes of 
state B'iB^A^AixAip, B4 and Bq in Tab, respectively, Cb4 and Cbb are their 
correlation matrixes, = diag(\, 0), Xp = diagiQ, 1) and AfP denotes the inverse 
on the range. Similar to Eq. (|6]), we obtain 

5 5 

S{E\xb,pb) ^Y.G{K) = E ^ {fK«n)) , (9) 

1=1 i=l 

where A- = fy.ia'^J is the symplectic eigenvalue of ^b1b^A2AixAip which is the 
function of the element ^^^V^b^A2AixAip^ seen in Appendix C. 

By substituting Eqs. ^ and © into Eq. ([1]), the secret key rate is obtained 



T. 7 5 

Kr = /3 log2 (/a. (a™n)) + E G (/a'. («™ J) ■ (10) 



In experiment, Alice and Bob can calculate every element of Eq. ([5]) according 
to the measurement values of the modes B2, Bi, Ai and A2, then calculate amn 
and q;J^j„ from Eqs. (|H) and Therefore, according to Eq. ([TU]). Eve's accessible 
information under Gaussian collective attacks is bounded and the secret key rate 
is obtained. Similarly, the security of other sub-protocols of the new two-way CV 
QKD can be analyzed. 

In theory, for the security analysis, we consider collective entangling doner at- 
tacks. Collective entangling doner attacks are a specific case of collective Gaus- 
sian attacks where the commu nicatio n channel is linear with transmittance T 
(0 < T < 1) and thermal noise .'i^'ISI xhe assumption of linear channel is often 
used since the linear channel is common in real experiment and easy to be numer- 
ically simulated. 

To get the elements of Eq. ^ for numerical simulation, we assume that the two 
channels are linear with the transmittances Ti and T2 and the noises referred to 
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the input Xi = £i + (1 ~ Ti)/Ti and X2 — £2 + — T2)/T2, respectively, where £1 
and £2 are the channel excess noises referred to the input. We can obtain 

- = ^ {1 + T2{Va - TaVa + T,Ta{V + xi) + X2)}I, 
7A. = [TaVa + Ti(1 - Ta){V + XI )] I, 



and 



where 



C2 ^\I\t2{1~Ta)Ta[Va~T^{V + xi)]\ 

1 



C4 = -\/^Ti(l-S)(V^2„iy^^ C5=ji7A(T/j-lK, (11) 



, 1 + TiT2Ta{1 + F) + T2{Va - TaVa + X2) 

""■""^^^ l + Tir2T^(l + F)+T2(l-T^ + X2) ' ^ ^ 



Substituting above equations into Eq. (flUl) . the secret key rate of Hetf^ protocol 
against collective entangling doner attacks can be obtained. Similarly, the secret key 
rate of the other sub-protocols of the new two-way CV QKD can be also obtained 
(seen in Appendix D). 



4. Numerical Simulation and Discussion on Collective Entangling 
Cloner Attacks 

For simplicity in numerical simulation, we only consider for Ti = T2 and xi = X2 
(or £1 = £2 = £)■ The tolerable excess noise e can be obtained when the se- 
cret key rate Kn is zero. When £, /3, T^, V and Va are known, the elements of 
^ B2xB2pBixBipA2AixAip are obtained from Eq. (fTTj) . Assuming that the typical 
fiber channel loss is 0.2 dB/km, with using Eq. ()10p . we numerically simulate e and 
Kn as the functions of the transmission distance by MATLAB. For comparison, the 
original Het^ protocol, the heterodyn e pr otocol (Het) and the homodyne proto- 
col (Horn) of one-way CV-QKD protocol^'^ are also numerically simulated in Figs. 
3(a) and (b), respectively. 

Fig. 3(a) shows the tolerable excess noise as a function of the transmission dis- 
tance for Hetfj protocol in the case that Ta changes and Va = V/{1 — Ta)- When 
choosing /3 = 0.99, V — 10^ and Ta — 0.3, 0.5, 0.8, the numerical simulation result 
indicates that the tolerable excess noise of Het^ goes up with the increase of T^. V 
and £ are in shot-noise units. When Ta approaches 1, the Het^^ protocol asymptot- 
ically approaches the original two-way protocol Het^ whose tolerable excess noise 
surpasses that of the corresponding one-way CV-QKD protocol.'^ The other new 
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sub-protocols also have similar numerical simulation results. Therefore, the new 
protocols maintain the same advantage as the original ones. 

Fig. 3(b) shows the secret key rate of all the new sub-protocols as a func- 




Fig. 3. (Color online) (a) Tolerable excess noise as a function of the transmission distance for 
Het'' (dashed line), Het (dot-dot-dashed line) and Het^ (solid line) protocols where T4 = 0.3 
(red), 0.5 (green), 0.8 (blue) when choosing /3 = 0.99, V = and Va = V/{1 - Ta). (b) Secret 
key rate as a function of the transmission distance for Hom-Hetm (dash-dash-dotted line), Het- 
HomM (dashed line), Het^ (solid line), Hom^ (dash-dotted line), Hom (dotted line) and Het 
(dot-dot-dashed line) protocols when choosing e = 0.2, /3 = 0.99, Ta = 0.8, and Va = V = 100. 




Fig. 4. (Color online) (a) Secret key rate of the new sub-protocol Het£j as a function of the 
transmission distance for e = 0.1 and /3 = 1,0.9,0.8,0.7. (b) Secret key rate of the new sub- 
protocol Het^ as a function of the transmission distance for /3 = 0.9 and e = 0.4,0.2,0.1,0.05. 
The curves are plotted for Ta = 0.8 and V = Va = 20. 
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tion of the tr ansmission distance for the noisy channeL Considering the practical 
schemepSEOl we choose e = 0.2, l3 = 0.99, Ta = 0.8 and V = Va ^ 100. The 
simulation resuh indicates that all new protocols have higher secret key rate than 
the one-way CV-QKD protocols. Note that the achievable transmission distance of 
Hom-HetM protocol is the longest in all the new sub-protocols. The reason is that, 
in Hom-HetM, Bob measures the mode B2 with heterodyne detection to get the 
position and momentum quadratures, but only uses one of them for reconciliation. 
This is equivalent to Bob implementing the homodyne detecti on with add ed noise. 
The properly added noise is useful to enhance secret key rate.^^^l^^ESlMI 

Both Fig. 4(a) and (b) show the secret key rate of the new sub-protocol Het£i 
as a function of the transmission distance where Ta = 0.8 and V = Va = 20. Fig. 
4(a) is plotted for e ~ 0.1 and /3 = 1,0.9,0.8,0.7. The simulation result indicates 
that the secret key rate of Het^ protocol increases with the increase of /?. Fig. 4(b) 
is plotted for /3 — 0.9 and e — 0.4, 0.2, 0.1, 0.05. The simulation result indicates that 
the secret key rate of Het^ protocol increases with the decrease of e. 

5. Conclusion 

In conclusion, we propose a family of new two-way CV-QKD protocols by replac- 
ing the displacement operation of the original two-way CV-QKD protocols with 
the passive operation on Alice's side. By using the optimality of Gaussian attack 
and the purification of the system. Eve's accessible information is bounded by the 
measurement values of Alice and Bob. The security of the new two-way CV-QKD 
protocols against collective entangling doner attacks is proved without randomly 
switching between one-way and two-way schemes for the quantum-channel tomog- 
raphy. Thus the PM scheme of our new protocol can be applied more practically. 
The simulation result indicates that the tolerable excess noise in the new proto- 
cols approaches the original ones when Ta is close to 1. Even if Ta and Va have 
real experimental values, the new two-way CV-QKD protocols still outperform the 
one-way protocols in secret key rate and transmission distance. Especially, the new 
sub-protocol Hom-HetM allows the distribution of secret keys over much longer 
distance than the one-way protocols. However, some open questions about the se- 
curity of the new two-way CV-QKD pro tocols stil l remain. In ou r proof, we h ave 
not analyzed the effects of the finite size,f25l36l37] ^j^g source noisJ^SElIinill] and 
the detection nois 

^29 

on the security. Especially, it is worthwhile to further in- 
vestigate the method to enhance the tolerable exces s noise of CV QKD by adding 
proper noise on the side of the sender or the receiver.^ '^^ l '^^ l '^'^ l '^^ l ^^ l These problems 
will be researched in our future work. 
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Appendix A. The Equivalence of Fig. 1(b) and Fig. 2 on Eve's 
Accessible Information 

In Fig. 1(b), Bob calculates two variables xb = xb^x ~ kxBix and pb = 

PB2p + kpBip after measuring Bix, B2X, Bip and i?2P- Wc name it as mcasure- 
and-calculate (MC) process. In Fig. 2, Bob measures the mode B4 (Bq) to get the 
variable XB4 = xb {pbs = Pb) after using two Tf- on the modes Bix, B2X, Bip 
and B2p. Wc name it as transform-and- measure (TM) process. In the following, we 
prove that the two processes are equivalent for Eve's entropy S{E) as well as con- 
ditional entropy S{E\xb,Pb) = !T^p{xB,PB)S{p''^'^'')dxBdpB, where p{xb,Pb) 
is the probability distribution oi xb and pb and p^^'^'^ is Eve's state when Bob's 
variables xb and pb are known. Wc use Bo to denote BixB2xB\pB2p, D to denote 
B3B4B5BQ, and Ao to denote AixAipA2. 

In MC process, after Bob measures Bix, B2X, Bip and B2P, the state pa^b^e 
is changed into pa„b'e- Thus 

/oo 
FBPA„BoEFBdXidX2dpidp2, (A.l) 
-00 

where 

Fb = \xi,X2,Pl,P2)Ba {X1,X2,P1,P2\ ■ (A.2) 

Fb indicates the measurement process that obtains the corresponding eigenvalues 
xi, X2, pi and p2 of Bix, B2X, -Bip and B2P. 

In order to get xb = X2 — kx\ and pb = P2 + kpi, we do the parameter 
transformation by replacing X2 and p2 with X2 = xb + kxi and p2 = Pb — kpi, 
respectively. For the conditional state, we fix and pb, and denote: 

/oo 
F'sPAoB^EF'edxidpi, (A.3) 
-00 



where 



F'b = \+-)bo 



= \xi,XB + kxi,pi,pB - kpi)g^{xi,XB + kxi,pi,pB - kpi\ . (A.4) 
When Xb and ps are known, Eve's state is 

tr^„B^ [pZi^E] 

tVA^B'^E (p7S!e) 

*'"^o(X!^So^'l>4>Pl>P2l PAoB^^ \x'i,x'2,p[,p'2)Bodx'idx'2(i{c^'^ 



tr (X!^So^i , a;'2 , p( , p'2 \ pTJ^^ \x'i , 4 > 1^ > P2)bo cfcicfc^4^4>^) 
tr^o (/^b„(H — \pAoBoeU — )Bodxidpi 



trA<,£; (/_!^b„(H — \PAoBoE |H — )Bodxidpij 



(A.5) 
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In TM process, the operation of the two unitary transformations Ffc is deno ted 
as S"^ which can transform \xi, xbiPiiPb) b i^^^o l^i' ^b + kxi,pi,pB — kpi) g 
After implementing the two unitary transformations F^, the original state pAaBaE is 
changed into PAoB^BiB^BeE = S pa^b^eS^ . When getting xb and pb by measuring 
i?4 and -Bg, the state is 

pXbsBsE^ BiBe{xB,PB\SpA,B„ES^ \xB.,PB)BiBs- (^-6) 

When Xb and pb are known, Eve's state is 

, / xb-Pb \ 

'XB,PB_ ^^ApBaBr, [.PAgBsBr^Ej 
Pe ~ . I xb,Pb \ 

trA^BsBr^E [Pa^BsBse) 

(r 0053-85(2^3,^5! PaI'bsB^E \x3,P5) BaBadxsdp^ 
tl'^o-E (/-!! S3 55(2^3,^5 1 PX'B^Br^E \x3,P5)BsBrJx3dp. 
*'"'4o ( J^ooD{x3,Xb,P5,Pb\ Spa^B.eS'^ \x3, XB,P5,PB}DdX3dpi 
tr^o-E ( J^^d{x3,Xb,P5,Pb\ SpA„BoES'^\x3,XB,P5,PB)DdX3dp5 

( I^ooBo{xi,Xb,Pi,Pb\ Spa.B^eS'^ \xi,XB,Pl,PB)B,dxidpi^ 
i^A^(^J^^BSxi,XB,Pl,PB\ SpA,BoES'^\xi,XB,Pl,PB)Bodxidpi^ 
t^'-^o ( I^ooBS-\ 1 PA^B^E |H )B„dxidpi 



tr^o-B ( /-!Lso(-l — I PA.BoE |H — )B„dxidpi 



(A.7) 



bmce Eq. (|X7)) is the same as Eq. (jA.5|) and P{xb,Pb) is proportion to 

tr^io-E ( /-!L■Bo(^ — I PAaBaE |H — )B<,rfa;i<^Pi) , 5(i?|a;s , P-b) is identical in MC process 
and TM process. The cases in the other new sub-protocols can be proved in the 
same way. 

In Fig. 2, because the state B2B1A2A1E is also a pure state, S{E) = 
S{B2BiA2Ai). Similarly, in Fig. 1(b), S{E) = S{B2BiA2Ai). Because the modes 
B2B1A2A1 are same to Figs. 1(b) and 2, S{E) is same. Therefore, Ibe is same to 
Figs. 1(b) and 2. 

Appendix B. The Calculation of Eq. <^ 

In Fig. 2, the corresponding covariance matrixes of EPR pairs of Alice and Bob are 



F -f W^a\ ( VaI ^Vf^a\ 

^B"^-\,/W^a, VI J' ^^'^^--yvr^a, VaI j' ^ ^ 

The two modes Bi and Ai are uncorrelated. The mode Ci is changed into the mode 
Ain through the channel. Alice couples one mode of her EPR pair with the mode 
Ain by the beam splitter Ta- The action of the beam splitter Ta is equivalent to a 
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unitary transformation. When the mode Aout is sent back to Bob, the corresponding 
covariance matrix of the modes B2B1A2A1 is 



libBiAjAi- 













Cxb^XA^ 





CxB^XA-i 


\ 





ypB2 










CpB^PA^ 





0*2 KAl 


Cx X 





V 





c 

Mrsj XA2 



















V 





QlBl PA2 








CxB^XAi 





Gcj3j XA2 










CA1A2 








Q>B2PA2 















-G41A2 













G11A2 





Va 





\ 


QpB^PAi 











-G41A2 





Va I 



,(B.2) 



where the diagonal elements correspond to the variances of x and p quadratures of 
the modes B2, Bi, A2 and Ai in turn, and the nondiagonal elements correspond 
to the covariances between modes. Note that the covariance between the modes 
Ai and A2 is CaiA2 = \JTa — 1), which is irrelevant to the channels since the 
mode A\ is only controlled by Alice and its values are random. 

In the heterodyne detection, a vacuum state is introduced by the beam split- 
ter. The corresponding covariance matrix of the modes B2B-1A2A1 and the three 
vacuum states Cqi , C02 and C03 is 



^ B2C01B1CQ2A2A1C03 



( y^B2 





CxB^XB^ 





ypB2 














1 











1 





Gcbj Xb-1 








V 





0*32 PBi 
































CXB2XA2 





^^CxB,XA2 













Cxb2XAi 





00 








Q®2EAl 


00 

















\ 















CxB^XA2 





0*2 PBi 








^'PB2 PA2 





























CxB^XA2 





V 








^PBi PA2 





1 











1 














y^ 





QsiPAj 








Vp^ 





Ca,A2 














— CaiA 



























C'XB2XAi 





00\ 





Q>B2PAi 






































































-CAIA2 





Va 











Va 











1 








V 



(B.3) 



By the unitary transformations of the three beam splitters, the modes 

B2B1A2A1 arc changed into the modes B2X B2pBix B1PA2A1X Aip . Its corre- 
sponding covariance matrix is ^B2xB2pBixBipA2AixAip = [Fbs © Tbs © I © 
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I 



Tbs = 



Tbs]^, where 
./I \ 



















V 



- 



(B.4) 



Therefore, Eq. ([5]) is obtained, in which 

T-B2X ^B2P I 



2 









Ci = 



C5: 




1A2 



c, = 



Ca = 



y^ 


)• 
















'^B2''^2 














'"PBl PA2 





-v^. 



(B.5) 



Every element of Eq. ([SJ can be obtained by the measurement values in experi- 
ment. For example, in the heterodyne detection on the mode B2, the x quadrature 
value xb2x of mode B2X and the p quadrature value Pb2p of the mode i?2P are 
obtained. There are the following relations 



XB2X 

PB2X 



-{XB2 + Xq), 

\iPB2 +Po), 



XB2P 

PB2P - 



{xq -XB2), 



^(PO -PB2), 



(B.6) 



where x B2 1 PB2 1 and po are the x and p quadratures of the mode B2 and the 
vacuum state, respectively, pb2x is the p quadrature of the mode B2X and xb2p is 
the X quadrature of the mode B2P- Then, we get 



- V^Xq. 



PB2X PB2P 

XB2P = -XB2X + v^a^o- (B.7) 

Therefore, the variances of p and x quadratures of the modes B2X and B2P can be 
calculated according to the measurement values xb2x and pb2p 

(Pkx) = (Pkp) - 2V2{pB2pPo) + 2 (pI) = (p|2p) ' 

i^kp) = i^kx) - 2V2{xB2xXo)+2{xl) = (xl^^) . (B.8) 
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Similarly, the covariances between modes can be calculated. For example, 

C2 = diag({xB^xXA2) , {PB2XPA2)) 

= diag {{XB2XXA2) , {-PB2PPA2)) , (B.9) 

where XA2 and PA2 are the measurement values of x and p quadratures of the mode 
A2 which are obtained by randomly measuring the x and p quadratures of the mode 
A2. 



Appendix C. The Calculation of Eigenvalues 

The corresponding covariance matrix F of a n-mode state has n eigenvalues A" 
for i — l,...,n where A" is the function of the element aj^„ of F. The symplectic 
invariants of the n-mode state {A„j} for j ~ 1, . 



are defined as^ 



(C.l) 



where — (BiicTy {cry standing for the y Pauli matrix) and M2j{^T) is the principal 
minor of order 2j of the 2n x 2n matrix flT which is the sum of the determinants 
of all the 2j x 2j submatrices of fiF obtained by deleting 2n — 2j rows and the 

AO 

corresponding 2n—2j columns. There are n independent symplectic invariants 
{A„j} which are the function of the element aj^„ of F. In addition, there is a 
relatiorP^ 



(C.2) 



where s" are the subsets of all the possible combinations of j integers within n 
where j is smaller than or equal to n. Therefore, the symplectic eigenvalues A" for 
i = 1, n are the solutions of the n order polynomial 



z"- A„,i z"-l+ A„,2 z""^- A„,3 z"-3 + ... A, 



0. 



(C.3) 



The solutions are denoted as 2; = (A")^ = fy'i'^mn) foi' * — l,...,n which are the 
function of the element aj^„ of the covariance matrix F. For n = 4, there are 



A4I 




2A 



f2 W W^'^^-u"^ W'^ti 



2A 



4,2 



4l 4A42 Q A|i~4A4.lA4.2+8A43 



-"41 

2 



4A4 



-e- 



A3i-4A4,iA4,2+8A43 



4A/^-^+e 



(C.4) 
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where 

H =A4_2 -3 A4,lA4,3 +12 A4,4, 

J = (l + ^L^ - 4^-3) ' , 

L = 2 a|_2 -9 A4,lA4,2A4,3 +27 A^ 3 +27 A^ iA4,4 -72 A4.2A4,4 ■ (C.5) 

By a unitary transformation, Tj^g can be changed into Eq. (jB.Sp . 
i.e., diag{TB2BiA2Aii^3)- Therefore, the eigenvalues of Tab are Xi = 
/Ai,2,3,4("mn), 1, 1, 1, where /ai,2,3,4 ("mn) are the eigenvalues of TB2B1A2A1 cal- 
culated according to Eq. (|C.4I) . By the unitary of the beam sphtter, there is 
[I3 © r^sfn;'^:A2M,A,Ah ® TbsI = d*a5(r^-^;^^^^,I), where r^:^.^.^, is 
the corresponding covariance matrix of a four-mode state. Thus, the eigenvalues of 
^BlB"A2A^xA^p ^re = /a'^^ 3 1, where A'^ ^ g Ja™„) are the eigenvalues 

of T^^Q^A2Ai calculated according to Eq. (|C.4p . 

Appendix D. The Secret Key Rate of the Hom^, Hom-HetM and 
Het-HoniM Protocols 

In Fig. 2, because S{E) = S{B2BiA2Ai) and the modes B2B1A2A1 are same to all 
the new two-way sub-protocols, S{E) is same. Therefore, we only need to consider 
the conditional entropy on Bob to calculate Ibe- 

In Hom^ protocol. Bob gets the variables xbi and XB2 by homodyne detection 
on the modes Bi and B2 and uses x'g — — kxBi fo'' postprocessing. This 
procedure is equivalent to the one where Bob uses F^; to change the modes Bi and 
B2 into B'^ and B'^. The corresponding covariance matrix of the system B'^Bi^Ao is 

^B',B',A^ - [Tk ® I3] rB2B,A^ [Tk © 13]^ , (D.l) 

where Fs^Sj^^ is obtained by applying the unitary transformation [FBs®rBs®l3] 
to Eq. ©. 

When Bob gets the x'g by measuring B'^, the state B'^AqE is a pure state, which 
means S{E\x'g) = SiB'^Aolx'g). Similar to Eq. ([6]), we get 

4 

^(i?|x^)^^G(A;.), (D.2) 

1=1 

where is the symplectic eigenvalue of the corresponding covariance matrix F^f ^ 

of the state -83^0 conditioned on x'g. F^f^ is calculated from T b'^b'^a^^^^ 

In Hom-HetM protocol. Bob gets the variable xbi by homodyne detection on 
Bi and gets the variables xb2x and pb2p by heterodyne detection on B2. Bob only 
uses x'g = XB2X — kxBi for postprocessing. This procedure is equivalent to the 
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one where Bob uses Ffc to change the modes B2X and Bi into B'^ and B'l. The 
corresponding matrix of the state B'lB'^B2pAo is 

Tb'ib-b,,a^ = [Ffc ® UTb,^b,b,pA„ [Tk ® 14]^, (D.3) 
where I4 = I3 I and ^ B2xBiB2pAo is obtained by applying the unitary transfor- 
mation [I ® I © Tbs © I3] to Eq. ©. 

When Bob gets the variable x'^ by measuring B'l, the state B'^B2pAoE is a pure 
state, which means S{E\x'q) — S {B'^ B2pAo\x'g) . Similar to Eq. ([SJ, we can get 

5(i?|x'^) = ^G(A;'), (D-4) 

1=1 

where A" is the symplectic eigenvalue of the corresponding covariance matrix 
r^f,^^ A state B'^B2pAo conditioned on x'^. T^f,^^ ^ is calculated from 

^ B'^ B'^ B2pAo ■ 

In Het-HomM protocol. Bob gets the variables Xbix and Pbip by heterodyne 
detection on Bi and gets the variable XB2 by homodyne detection on B2. Bob only 
uses Xg = XB2 ~ kxBix for postprocessing. This procedure is equivalent to the 
one where Bob uses Tk to change the modes Bix and B2 into Bg" and B'l' . The 
corresponding matrix of the state B'l' B'-^' BipAo is 

Tb'^'B'^'b.^a^ = [Tk © l4]rs.BixBipA„ [Tk © 14]^, (D.5) 

where ^B2BixBipAo is obtained by applying the unitary transformation [rBsffil4ffiI] 
to Eq. dSl). 

When Bob gets the variable x'^ by measuring B'l' , the state B'^' BipAqE is a 
pure state, which means S{E\x'g) = S{B'l' BipAo\x'g). Similar to Eq. ([5]), we can 
get 

where A"' is the symplectic eigenvalue of the corresponding covariance matrix 
r^f,,^ A of the state Bg'SipAo conditioned on a;^'. r^f„g ^ is calculated from 

In addition, we can obtain that, in Hom^ protocol, 

, 1, Va-TaVa+TaT,F + x2 

Iba = log2 — j — rj. ^ F , ' 

2 1 - Ta + TaTiF + X2 

in Hom-HetM protocol, 

, 1, 1 + T,T2TaF + T2iVA - TaVa + X2) 
- 2 1 + T,T2TaF + T2{1-Ta + X2) ' 

and in Het-HomM protocol, 

Iba = ;^ logs — ^ , n i fa . ' 

2 1 - + JaFi (1 -f F) -I- X2 

According to Eq. ([1]) , the secret key rate of above sub-protocols can be obtained. 
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